A workload runs across thousands of EC2 instances in a VPC that has public and private subnets. Public subnets route 0.0.0.0/0 to an internet gateway; private subnets route 0.0.0.0/0 to a NAT gateway. You must migrate the fleet to IPv6 while ensuring instances in private subnets are not reachable from the public internet. What should the solutions architect do?

The correct solution involves associating an Amazon-provided IPv6 CIDR block to the VPC and all subnets. For private subnets, an egress-only internet gateway (EIGW) is essential. EIGWs allow instances in private subnets to initiate outbound IPv6 communication to the internet while preventing unsolicited inbound connections from the internet, fulfilling the requirement that instances are not reachable from the public internet. Routing ::/0 to the EIGW for private subnets ensures this outbound-only connectivity. Incorrect options: Routing ::/0 to an internet gateway for private subnets would make them publicly reachable, violating the requirement. A NAT gateway is used for IPv4; for IPv6, an EIGW serves a similar purpose for outbound-only internet access from private subnets. There is no "IPv6-enabled NAT gateway" in AWS. Custom IPv6 CIDR blocks are not supported for VPCs; only Amazon-provided IPv6 CIDR blocks can be associated.